---
title: "Update OAuth client (admin)"
method: PUT
path: "/admin/oauth/clients/{client_id}"
tags: ["admin", "oauth-server"]
---

# Update OAuth client (admin)

`PUT /admin/oauth/clients/{client_id}`

Updates an existing OAuth client registration. Only the provided fields will be updated. Only available when OAuth server is enabled.

## Request body

- object
  - `client_name` string — Human-readable name of the client application
  - `client_uri` string, uri — URL of the client application's homepage
  - `logo_uri` string, uri — URL of the client application's logo
  - `redirect_uris` string[] — Array of redirect URIs used by the client
  - `grant_types` string[] — OAuth grant types the client is authorized to use
  - `token_endpoint_auth_method` 'none' | 'client_secret_basic' | 'client_secret_post' — Authentication method for the token endpoint. Must be compatible with the client's current client_type. Confidential clients can use 'client_secret_basic' or 'client_secret_post'. Public clients can only use 'none'.

## Response `200`

OAuth client updated successfully

- OAuthClientSchema — Represents an OAuth 2.1 client
  - `client_id` string — Unique client identifier
  - `client_name` string — Human-readable name of the client application
  - `client_secret` string — Client secret for confidential clients (only returned on registration/regeneration)
  - `client_type` 'public' | 'confidential' — Type of the client
  - `token_endpoint_auth_method` 'none' | 'client_secret_basic' | 'client_secret_post' — Authentication method for the token endpoint
  - `registration_type` 'dynamic' | 'manual' — Registration type of the client
  - `client_uri` string, uri — URL of the client application's homepage
  - `logo_uri` string, uri — URL of the client application's logo
  - `redirect_uris` string[] — Array of redirect URIs used by the client
  - `grant_types` string[] — OAuth grant types the client is authorized to use
  - `response_types` string[] — OAuth response types the client can use
  - `scope` string — Space-separated list of scope values
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `400` — Bad request - validation failed or no fields provided for update
- `401` — HTTP Unauthorized response.
- `403` — HTTP Forbidden response.
- `404` — OAuth client not found

---

[API](https://skmtc.net/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.net/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/versions/2664b89bee49/schema)